Laserfiche WebLink
● Time-limited (max 4 hours per ticket) <br />● Customer approval required for each session <br />● MFA enforced for all vendor personnel <br />● Complete audit logging of all vendor actions <br />● No permanent vendor accounts <br />Logging & Auditability (Section 3): <br />● Comprehensive event logging (authentication, data access, admin actions) <br />● 1-year minimum retention (configurable) <br />● Tamper-resistant storage with SHA-256 hashing <br />● SIEM integration (syslog, CSV, JSON, CEF formats) <br />● Chain of custody for all data exports <br />Security Attestations (Section 4): <br />● SOC 2 Type II: Expected Q2 2026 (currently in progress) <br />● Penetration Testing: Annual (next: January 2026) <br />● Vulnerability Assessments: Quarterly <br />● CJIS Compliance: Architecture supports Customer's CJIS obligations <br />● FIPS 140-2: Validated cryptographic platform (AlmaLinux 9) <br />Encryption (Section 5): <br />● In Transit: TLS 1.3/1.2 with strong cipher suites, Perfect Forward Secrecy <br />● At Rest: AES-256, full-disk encryption, Customer-managed keys <br />Incident Response (Section 6): <br />● Immediate containment and phone notification within 4 hours <br />● Preliminary report within 24 hours <br />● Detailed report with root cause analysis within 72 hours <br />● Forensic cooperation and regulatory assistance <br />Service Level Agreement (Section 12): <br />● Availability: 99.5% monthly uptime target <br />● Support Response Times: <br />○ Severity 1 (Critical): 2 hours, 24/7 <br />○ Severity 2 (High): 4 business hours <br />○ Severity 3 (Medium): 1 business day <br />○ Severity 4 (Low): 2 business days <br />● Performance Guarantees: <br />○ 95% of searches complete in <3 seconds <br />○ 99% of searches complete in <10 seconds <br />● Service Credits: 5-50% of monthly fees for availability failures <br /> <br />DOCUMENT RELATIONSHIP & PRECEDENCE <br />Docusign Envelope ID: 7C14E910-C8FB-4538-B7C4-4EC888D7DD0A